PKINIT: return NULL instead of an empty challenge

When putting together the set of identity prompts for a responder
challenge, if we don't need a PIN or password of some kind, just return
NULL instead of returning an empty JSON object.
Teach responder test helper to check for "no challenge"

Teach the responder test helper to recognize when we expect that there's
no challenge for a given question name.  For example, when there's no
OTP token info, or no PKINIT identity for which we need a PIN or
password.
PKINIT testing: don't always expect responder questions

When testing authenticated (non-anonymous) PKINIT, expect to get a
challenge from PKINIT only when there's a smart card that requires login
or there's a private key that needs to be decrypted.  Add PKCS11 tests
which use an unencrypted key, and check that we also don't produce a
challenge question when using it.